- “Biometric Data” means personal data resulting from specific technical processing, relating to the physical, physiological or behavioural characteristics of an individual, that allow or confirm the unique identification of that individual, such as facial images or dactyloscopic data.
- “Data Concerning Health” means personal data relating to the physical or mental health of an individual, including the provision of healthcare services that reveal information about his or her health status.
- “Genetic Data” means personal data relating to the inherited or acquired genetic characteristics of an individual that give unique information about the physiology or the health of that individual and which result, in particular, from an analysis of a biological sample from the individual in question.
3. Territorial and Material Scope
3.1 Do the data protection laws apply to businesses established in other jurisdictions? If so, in what circumstances would a business established in another jurisdiction be subject to those laws?
The Regulations apply to the following:
- A data controller established in the Island where the personal data is processed in the context of the activities of that establishment.
- A data processor processing personal data where the data processor is established in the Island and the personal data is processed in the context of the activities of that establishment.
- A data controller or data processor processing personal data where the data controller or data processor is not established in the Island but uses equipment in the Island for processing the personal data other than for the purposes of transit through the Island.
- A data controller established outside the Island where the personal data being processed relate to an individual who is in the Island when the processing takes place and the purpose of the processing is to offer goods or services to individuals in the Island, whether or not for payment or to monitor individuals’ behaviour in the Island.
- A data processor processing personal data for a data controller outside the Island or a data processor outside the Island where the personal data being processed relate to an individual who is in the Island when the processing takes place and the purpose of the processing is to offer goods or services to individuals in the Island, whether or not for payment or to monitor individuals’ behaviour in the Island.
3.2 Do the data protection laws in your jurisdiction carve out certain processing activities from their material scope?
Within the Isle of Man, processing by a natural person in the course of a purely personal or household activity is not captured under the Data Protection legislation.
4. Key Principles
4.1 What are the key principles that apply to the processing of personal data?
- Transparency: Personal data must be processed lawfully, fairly and in a transparent manner. Controllers must provide certain minimum information to data subjects regarding the collection and further processing of their personal data. Such information must be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
- Lawful basis for processing: Processing of personal data is lawful only if, and to the extent that, it is permitted under Isle of Man data protection law. The law provides an exhaustive list of legal bases on which personal data may be processed, of which the following are the most relevant for businesses: (i) prior, freely given, specific, informed and unambiguous consent of the data subject; (ii) contractual necessity (i.e., the processing is necessary for the performance of a contract to which the data subject is a party, or for the purposes of pre-contractual measures taken at the data subject’s request); (iii) compliance with legal obligations (i.e., the controller has a legal obligation to perform the relevant processing); or (iv) legitimate interests (i.e., the processing is necessary for the purposes of legitimate interests pursued by the controller, except where the controller’s interests are overridden by the interests, fundamental rights or freedoms of the affected data subjects).
- Purpose limitation: Personal data may only be collected for specified, explicit and legitimate purposes and must not be further processed in a manner that is incompatible with those purposes. If a controller wishes to use the relevant personal data in a manner that is incompatible with the purposes for which they were initially collected, it must: (i) inform the data subject of such new processing; and (ii) be able to rely on a lawful basis as set out above.
- Data minimisation: Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which those data are processed. A business should only process the personal data that it actually needs to process in order to achieve its processing purposes.
- Proportionality: Personal data must be accurate and, where necessary, kept up to date. A business must take every reasonable step to ensure that personal data that are inaccurate are either erased or rectified without delay.
- Retention: Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
- Accuracy: Reasonable steps must be taken to ensure that the personal data held is not incorrect or misleading. If it is found that personal data is incorrect or misleading, then reasonable steps must be taken to correct or delete it as soon as possible.
- Data security: Personal data must be processed in a manner that ensures appropriate security of those data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
- Accountability: The controller is responsible for, and must be able to demonstrate, compliance with the data protection principles set out above. This includes compliance with the rights of data subjects.
5. Individual Rights
5.1 What are the key rights that individuals have in relation to the processing of their personal data?
- Right of access to (copies of) data/information about processing: A data subject has the right to obtain from a controller the following information in respect of the data subject’s personal data: (i) confirmation of whether, and where, the controller is processing the data subject’s personal data; (ii) information about the purposes of the processing; (iii) information about the categories of data being processed; (iv) information about the categories of recipients with whom the data may be shared; (v) information about the period for which the data will be stored (or the criteria used to determine that period); (vi) information about the existence of the rights to erasure, to rectification, to restriction of processing and to object to processing; (vii) information about the existence of the right to complain to the relevant data protection authority; (viii) where the data were not collected from the data subject, information as to the source of the data; and (ix) information about the existence of, and an explanation of the logic involved in, any automated processing that has a significant effect on the data subject. Additionally, the data subject may request a copy of the personal data being processed.
- Right to rectification of errors: Controllers must ensure that inaccurate or incomplete data are erased or rectified. Data subjects have the right to rectification of inaccurate personal data.
- Right to deletion/right to be forgotten: Data subjects have the right to erasure of their personal data (the “right to be forgotten”) if: (i) the data are no longer needed for their original purpose (and no new lawful purpose exists); (ii) the lawful basis for the processing is the data subject’s consent, the data subject withdraws that consent, and no other lawful ground exists; (iii) the data subject exercises the right to object, and the controller has no overriding grounds for continuing the processing; (iv) the data have been processed unlawfully; or (v) erasure is necessary for compliance with data protection law.
- Right to object to processing: Data subjects have the right to object, on grounds relating to their particular situation, to the processing of personal data where the basis for that processing is either public interest or legitimate interest of the controller. The controller must cease such processing unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the relevant data subject or requires the data in order to establish, exercise or defend legal rights.
- Right to restrict processing: Data subjects have the right to restrict the processing of personal data, which means that the data may only be held by the controller, and may only be used for limited purposes if: (i) the accuracy of the data is contested (and only for as long as it takes to verify that accuracy); (ii) the processing is unlawful and the data subject requests restriction (as opposed to exercising the right to erasure); (iii) the controller no longer needs the data for their original purpose, but the data are still required by the controller to establish, exercise or defend legal rights; or (iv) verification of overriding grounds is pending, in the context of an erasure request.
- Right to data portability: Data subjects have a right to receive a copy of their personal data in a commonly used machine-readable format, and to transfer their personal data from one controller to another or have the data transmitted directly between controllers.
- Right to withdraw consent: A data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject must be informed of the right to withdraw consent. It must be as easy to withdraw consent as to give it.
- Right to object to marketing: Data subjects have the right to object to the processing of personal data for the purpose of direct marketing, including profiling.
- Right protecting against solely automated decision-making and profiling: Data subjects have the right not to be subject to a decision that is based solely on automated processing (including profiling), which produces legal effects concerning them or significantly affecting them.
- Right to complain to the relevant data protection authority(ies): Data subjects have the right to lodge complaints concerning the processing of their personal data with the ICO, if the data subjects live in the Isle of Man or the alleged infringement occurred in the Isle of Man.
5.2 Please confirm whether data subjects have the right to mandate not-for-profit organisations to seek remedies on their behalf or seek collective redress.
Data subjects can make a complaint to the Isle of Man ICO. The ICO deals with complaints on the following:
- data protection legislation;
- the UCR (Electronic Direct Marketing);
- the Freedom of Information Act; and
- the Code of Practice on Access to Government Information.
The specific right for a data subject to mandate a not-for-profit organisation to seek a remedy on their behalf or to seek collective redress is not included in the Isle of Man’s data protection framework.
6. Children’s Personal Data
6.1 What additional obligations apply to the processing of children’s personal data?
The Data Protection (Application of GDPR) Order 2018 (the “applied GDPR”) makes specific reference to children and the processing of their data.
Specific protection should be applied to the use of personal data of children for the purposes of marketing or creating personality or user profiles, as well as to the collection of personal data with regard to children when using services offered directly to a child.
Data controllers must be aware if they process children’s data and ensure there are adequate safeguards and procedures in place as the following provisions apply to, or restrict, processing:
- Article 6(1)(f) – Legitimate interest ground for processing. Processing the personal data of children represents an enhanced risk.
- Article 8 – Conditions applicable to a child’s consent in relation to information society services. Consent cannot be given by a child below the age of 13.
- Article 12 – Fair processing information. Fair processing information “addressed to a child, should be in such a clear and plain language that the child can easily understand”.
- Article 17 – Right to erasure. Where “the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child”.
- Article 22 – Automated decisions, including profiling, are not permitted.
7. Registration Formalities and Prior Approval
7.1 Is there a legal obligation on businesses to register with or notify the data protection authority (or any other governmental body) in respect of its processing activities?
Personal data must not be processed unless an entry in respect of the data controller is included in the register maintained by the ICO, subject to certain exemptions. The registration requirement also extends to data processors.
7.2 If such registration/notification is needed, must it be specific (e.g., listing all processing activities, categories of data, etc.) or can it be general (e.g., providing a broad description of the relevant processing activities)?
Registration is limited to some basic information in relation to the controller or processor, including the nature of its business and the details of the Data Protection Officer or other appropriate contact.
7.3 On what basis are registrations/notifications made (e.g., per legal entity, per processing purpose, per data category, per system or database)?
Registration is required on a “per data controller” or “per data processor” basis.
7.4 Who must register with/notify the data protection authority (e.g., local legal entities, foreign legal entities subject to the relevant data protection legislation, representative or branch offices of foreign legal entities subject to the relevant data protection legislation)?
The Regulations require every controller and processor to which the applied GDPR applies, to register subject to certain exemptions, which are set out in Schedule 7 to the Regulations. Section 3 above sets out the scope of the Regulations in terms of the entities to which they apply.
7.5 What information must be included in the registration/notification (e.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes)?
Registration is limited to some basic information in relation to the controller or processor, including the nature of its business and the details of the Data Protection Officer or other appropriate contact.
7.6 What are the sanctions for failure to register/notify where required?
Controllers and processors commit an offence if they process data without a registration when there is no applicable exemption, and when they fail to notify the ICO of changes to their registration information. These offences carry fines of up to £10,000 and directors may also be personally liable for offences.
7.7 What is the fee per registration/notification (if applicable)?
Fees are prescribed by the Treasury in the Data Protection (Fees) Regulations 2018. The fees are currently set at £70, although the ICO notes that the Council of Ministers may decide to amend that in the future. Exemptions from fees are available for relevant bodies where processing is limited to certain activities.
7.8 How frequently must registrations/notifications be renewed (if applicable)?
Registration must be renewed annually.
7.9 Is any prior approval required from the data protection regulator?
Prior approval in advance of registration is not required.
7.10 Can the registration/notification be completed online?
The registration can be completed online via the ICO’s website.
7.11 Is there a publicly available list of completed registrations/notifications?
There is a publicly available list of completed registrations, which is available on the ICO’s website.
7.12 How long does a typical registration/notification process take?
As registration can be completed online, it is an almost instant process, with the ICO then issuing an acknowledgment and payment details shortly thereafter.
8. Appointment of a Data Protection Officer
8.1 Is the appointment of a Data Protection Officer mandatory or optional? If the appointment of a Data Protection Officer is only mandatory in some circumstances, please identify those circumstances.
The appointment of a Data Protection Officer for controllers or processors is only mandatory in some circumstances, including where there is: (i) large-scale regular and systematic monitoring of individuals; or (ii) large-scale processing of special-category personal data. Where a business designates a Data Protection Officer voluntarily, the requirements of the GDPR apply as though the appointment were mandatory.
8.2 What are the sanctions for failing to appoint a Data Protection Officer where required?
In the circumstances where appointment of a Data Protection Officer is mandatory, failure to comply may result in a penalty.
8.3 Is the Data Protection Officer protected from disciplinary measures, or other employment consequences, in respect of his or her role as a Data Protection Officer?
The appointed Data Protection Officer should not be dismissed or penalised for performing their tasks and should report directly to the highest management level of the controller or processor.
8.4 Can a business appoint a single Data Protection Officer to cover multiple entities?
A single Data Protection Officer is permitted by a group of undertakings, provided that the Data Protection Officer is easily accessible from each establishment.
8.5 Please describe any specific qualifications for the Data Protection Officer required by law.
The Data Protection Officer should be appointed on the basis of professional qualities and should have an expert knowledge of data protection law and practices. While this is not strictly defined, it is clear that the level of expertise required will depend on the circumstances. For example, the involvement of large volumes of sensitive personal data will require a higher level of knowledge.
8.6 What are the responsibilities of the Data Protection Officer as required by law or best practice?
A Data Protection Officer should be involved in all issues that relate to the protection of personal data. The applied GDPR outlines the minimum tasks required by the Data Protection Officer as including: (i) informing the controller, processor and their relevant employees who process data of their obligations under the law; (ii) monitoring compliance with data protection legislation and internal policies in relation to the processing of personal data including internal audits; (iii) advising on data protection impact assessments and the training of staff; and (iv) co-operating with the data protection authority and acting as the authority’s primary contact point for issues related to data processing.
8.7 Must the appointment of a Data Protection Officer be registered/notified to the relevant data protection authority(ies)?
Yes, the controller or processor must notify the data protection authority of the contact details of the designated Data Protection Officer.
8.8 Must the Data Protection Officer be named in a public-facing privacy notice or equivalent document?
The Data Protection Officer does not necessarily need to be named in the public-facing privacy notice. However, the contact details of the Data Protection Officer must be notified to the data subject when personal data relating to that data subject are collected.
9. Appointment of Processors
9.1 If a business appoints a processor to process personal data on its behalf, must the business enter into any form of agreement with that processor?
Yes. The business that appoints a processor to process personal data on its behalf is required to enter into an agreement with the processor that sets out the subject matter for processing, the duration of processing, the nature and purpose of processing and the obligations and rights of the controller (i.e., the business).
It is essential that the processor appointed by the business complies with data protection requirements.
9.2 If it is necessary to enter into an agreement, what are the formalities of that agreement (e.g., in writing, signed, etc.) and what issues must it address (e.g., only processing personal data in accordance with relevant instructions, keeping personal data secure, etc.)?
The processor must be appointed under a binding agreement in writing. The contractual terms must stipulate that the processor: (i) only acts on the documented instructions of the controller; (ii) imposes confidentiality obligations on all employees; (iii) ensures the security of personal data that it processes; (iv) abides by the rules regarding the appointment of sub-processors; (v) implements measures to assist the controller with guaranteeing the rights of data subjects; (vi) assists the controller in obtaining approval from the Data Protection Officer; (vii) either returns or destroys the personal data at the end of the relationship; and (viii) provides the controller with all the information necessary to demonstrate compliance with the data protection requirements.
10. Marketing
10.1 Please describe any legislative restrictions on the sending of electronic direct marketing (e.g., for marketing by email or SMS, is there a requirement to obtain prior opt-in consent of the recipient?).
The following provisions apply:
- Direct marketing activities must generally comply with the Regulations, and the applied GDPR and direct marketing communicated by electronic messages (including email, SMS and picture messaging) must comply with the UCR.
- Persons marketing by way of electronic mail (email, SMS or picture messaging) must obtain consent of the individual prior to transmission, or instigation of transmission, unless the conditions of a “soft opt-in” are met. The conditions of the soft opt-in are that: (i) the person marketing has obtained the relevant individual’s details in the course of selling or negotiating a sale of products or services offered by such person; (ii) the direct marketing only markets the same person’s similar products and services; (iii) the individual was given the opportunity to opt-out of marketing when their details were first collected but did not opt-out at that point; and (iv) the individual is given the opportunity to opt-out on each subsequent marketing communication.
- All consent requirements under the UCR can currently be validly obtained by either opt-in or opt-out consent.
The Regulations provide that the ICO will issue a direct marketing Code to contain practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation. This Code has not yet been made available.
10.2 Are these restrictions only applicable to business-to-consumer marketing, or do they also apply in a business-to-business context?
The restrictions that must be adhered to are applicable in both the business-to-consumer and business-to-business contexts, provided that the marketing is targeted at an individual. There are no separate regulations.
10.3 Please describe any legislative restrictions on the sending of marketing via other means (e.g., for marketing by telephone, a national opt-out register must be checked in advance; for marketing by post, there are no consent or opt-out requirements, etc.).
The following provisions apply:
- Direct marketing activities must generally comply with the Regulations and the applied GDPR, and direct marketing communicated by telephone calls or faxes must comply with the UCR.
- Direct marketing by post is not subject to specific regulation, but any processing of personal data for the purpose of direct marketing must be done in compliance with the principles of the Regulations and the applied GDPR.
- Persons marketing by way of live telephone calls may not make unsolicited calls if either: (i) the individual or corporation contacted has previously notified the person marketing that such calls should not be made to such individual’s or corporation’s telephone number; or (ii) the telephone number is listed on the register provided by the UK Telephone Preference Service (to whom the responsibility of maintaining the Isle of Man register has been delegated).
- Automated telephone marketing calls may only be made with the consent of the individual or corporation to whom such calls are directed.
The Regulations provide that the ICO will issue a direct marketing Code to contain practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the data protection legislation. This Code has not yet been made available.
10.4 Do the restrictions noted above apply to marketing sent from other jurisdictions?
The ICO has a range of powers under the Regulations and the applied GDPR where breaches of marketing restrictions were due to data protection issues.
10.5 Is/are the relevant data protection authority(ies) active in enforcement of breaches of marketing restrictions?
The ICO has a range of powers under the Regulations and the applied GDPR where breaches of marketing restrictions were due to data protection issues.
10.6 Is it lawful to purchase marketing lists from third parties? If so, are there any best practice recommendations on using such lists?
There is no legal restriction to prevent the purchase of marketing lists from third parties. A data controller would, however, have to give serious consideration to the origin of the list and the data subject’s awareness that their data has been sold in this way in order to ensure compliance with the data protection requirements.
10.7 What are the maximum penalties for sending marketing communications in breach of applicable restrictions?
There are no specific penalties set out in the current law. A person suffering damage by reason of contravention of the law is entitled to bring proceedings for financial compensation against the person contravening the law.
11. Cookies
11.1 Please describe any legislative restrictions on the use of cookies (or similar technologies).
The UCR implemented Article 13 of the European Privacy and Electronic Communications Directive (2002/58/EC) (the “Privacy Directive”). The UCR have not yet been amended to incorporate the changes made to the Privacy Directive in May 2011 regarding cookies. As a result, the requirements of the Privacy Directive are regarded as “best practice” only on the Isle of Man, and implementation of the guidance relating to cookies remains voluntary.
11.2 Do the applicable restrictions (if any) distinguish between different types of cookies? If so, what are the relevant factors?
As above, there is no specific legislation or binding guidance regarding cookies on the Isle of Man.
11.3 To date, has/have the relevant data protection authority(ies) taken any enforcement action in relation to cookies?
There is no evidence that the ICO has taken any enforcement action in relation to cookies.
11.4 What are the maximum penalties for breaches of applicable cookie restrictions?
There are no relevant penalties.
12. Restrictions on International Data Transfers
12.1 Please describe any restrictions on the transfer of personal data to other jurisdictions.
Under the Regulations and applied GDPR, data transfers to a third country can only take place if the transfer is to an “Adequate Jurisdiction” (as specified by the EU Commission) or approval has been obtained from the ICO in respect of any measures that the data controller is proposing to take in accordance with the applied GDPR. A third country is defined as a State, territory or jurisdiction other than the Isle of Man and which is not a Member State of the European Union. The Isle of Man Parliament has approved the Data Protection (Withdrawal from the EU) (UK and Gibraltar) Regulations 2019, which enable data transfers to both territories to continue without additional safeguards post-Brexit.
12.2 Please describe the mechanisms businesses typically utilise to transfer personal data abroad in compliance with applicable transfer restrictions (e.g., consent of the data subject, performance of a contract with the data subject, approved contractual clauses, compliance with legal obligations, etc.).
Subject to approval from the ICO, when transferring personal data to a third country, businesses must ensure that there are appropriate safeguards on the data transfer, as prescribed by the applied GDPR.
The applied GDPR offers a number of ways to ensure compliance for international data transfers, of which one is consent of the relevant data subject. Other common options are the use of Standard Contractual Clauses (“SCCs”) or Binding Corporate Rules (“BCRs”).
Businesses can adopt the SCCs drafted by the EU Commission – these are available for transfers between controllers, and transfers between a controller (as exporter) and a processor (as importer). International data transfers may also take place on the basis of contracts agreed between the data exporter and data importer, provided that they conform to the protections outlined in the applied GDPR and have prior approval by the relevant data protection authority.
International data transfers within a group of businesses can be safeguarded by the implementation of BCRs. The BCRs will always need approval from the relevant data protection authority. Most importantly, the BCRs will need to include a mechanism to ensure they are legally binding and enforced by every member in the group of businesses. Among other things, the BCRs must set out the group structure of the businesses, the proposed data transfers and their purpose, the rights of data subjects, the mechanisms that will be implemented to ensure compliance with the GDPR, and the relevant complaints procedures.
12.3 Do transfers of personal data to other jurisdictions require registration/notification or prior approval from the relevant data protection authority(ies)? Please describe which types of transfers require approval or notification, what those steps involve, and how long they typically take.
Under the applied GDPR, the ICO must approve any transfer of personal data to a third country that is not subject to an adequacy decision or where additional safeguards cannot be put in place.
12.4 Do transfers of personal data to other jurisdictions require a transfer impact assessment? If conducting a transfer impact assessment is only mandatory in some circumstances, please identify those circumstances.
A Transfer Impact Assessment (“TIA”) is a legal requirement when an EU-based data exporter intends to process a restricted transfer under Article 46 of the GDPR. A TIA is not required where the restricted transfer is to a country covered by the EU adequacy decision or an Article 49 exemption exists.
12.5 What guidance (if any) has/have the data protection authority(ies) issued following the decision of the Court of Justice of the EU in Schrems II (Case C‑311/18)?
Following the Schrems II case in 2020, the UK adopted two sets of SCCs, one to be used between controllers and processors within the EEA and the other for transfer of any personal data outside of the EEA. The new SCCs deem that an organisation must undertake a transfer risk assessment before they transfer data under Article 46.
12.6 What guidance (if any) has/have the data protection authority(ies) issued in relation to the use of standard contractual/model clauses as a mechanism for international data transfers?
The Isle of Man ICO has not published any independent advice on the use of standard contractual/model clauses in regard to international data transfers. The Isle of Man ICO website advises that there are clauses that can be used and points users towards the guidance issued by the European Commission.
13. Whistle-blower Hotlines
13.1 What is the permitted scope of corporate whistle-blower hotlines (e.g., restrictions on the types of issues that may be reported, the persons who may submit a report, the persons whom a report may concern, etc.)?
There is no reference to whistle-blowing within the data protection law or regulations. Normal standards of data protection would be expected to apply to any data processed as a result of operating such a hotline.
13.2 Is anonymous reporting prohibited, strongly discouraged, or generally permitted? If it is prohibited or discouraged, how do businesses typically address this issue?
There is no reference to whistle-blowing within the data protection law or regulations and so there are no restrictions around anonymous reporting. Generally, regulatory and government guidance on whistle-blowing encourages the reporter to disclose their name to assist in appropriate action being taken.
14. CCTV
14.1 Does the use of CCTV require separate registration/notification or prior approval from the relevant data protection authority(ies), and/or any specific form of public notice (e.g., a high-visibility sign)?
Prior approval is not required from the ICO to use CCTV. A separate notification is also not required. The ICO’s guidance recommends the use of clear and visible signage, which includes who to contact about the operation of the CCTV system.
14.2 Are there limits on the purposes for which CCTV data may be used?
The ICO’s guidance states that there must be a lawful reason for considering the use of CCTV that cannot be met in another way. The ICO also suggests that the appropriateness for use of CCTV should be kept under review. Cameras should not be installed in private areas unless there are exceptional circumstances.
15. Employee Monitoring
15.1 What types of employee monitoring are permitted (if any), and in what circumstances?
Employee monitoring is permitted, provided that compliance with the data protection legislation is achieved. Monitoring must be proportionate to the intended aim, not adversely impact the privacy of the individuals, and be justified by its benefit to the employer. It would generally be viewed as unfair to tell employees that monitoring is being undertaken for one purpose and then use the information obtained for another purpose.
15.2 Is consent or notice required? Describe how employers typically obtain consent or provide notice.
Employers are required, on an ongoing basis, to make employees aware of any monitoring that is undertaken and the reasons for it, except in the exceptional limited circumstances where covert monitoring is necessary. Consent would only be required where an employer needed to rely on it as a legitimising condition for the processing of the personal data in accordance with the data protection legislation. Employers typically provide notice through a range of measures such as inclusion in the staff handbook, notices in the workplace and regular reminders through formal and informal communications. Employers typically obtain consent through clear and specific fair-processing notices signed by the employees.
15.3 To what extent do works councils/trade unions/employee representatives need to be notified or consulted?
There is no requirement for such representatives to be notified or consulted.
15.4 Are employers entitled to process information on an employee’s attendance in office (e.g., to monitor compliance with any internal return-to-office policies)?
Employees’ attendance can be monitored so long as it is done in a way that is compliant with Data Protection Law. In order to process and collect the data from employees, a lawful basis for processing must be identified. In addition, the Privacy Notice for employees should be transparent as to the data collected, its purpose and the legal basis for processing.
16. Data Security and Data Breach
16.1 Is there a general obligation to ensure the security of personal data? If so, which entities are responsible for ensuring that data are kept secure (e.g., controllers, processors, etc.)?
Yes. Personal data must be processed in a way that ensures security and safeguards against unauthorised or unlawful processing, accidental loss, destruction and damage of the data.
Both controllers and processors must ensure they have appropriate technical and organisational measures to meet the requirements of the data protection legislation. Depending on the security risk, this may include the encryption of personal data, the ability to ensure the ongoing confidentiality, integrity and resilience of processing systems, an ability to restore access to data following a technical or physical incident, and a process for regularly testing and evaluating the technical and organisational measures for ensuring the security of processing.
16.2 Is there a legal requirement to report data breaches to the relevant data protection authority(ies)? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.
The controller is responsible for reporting a personal data breach without undue delay (and in any case within 72 hours of first becoming aware of the breach) to the relevant data protection authority, unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject(s). A processor must notify any data breach to the controller without undue delay.
The notification must include the nature of the personal data breach, including the categories and number of data subjects concerned, the name and contact details of the Data Protection Officer or relevant point of contact, the likely consequences of the breach and the measures taken to address the breach, including attempts to mitigate possible adverse effects.
16.3 Is there a legal requirement to report data breaches to affected data subjects? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.
Controllers have a legal requirement to communicate the breach to the data subject, without undue delay, if the breach is likely to result in a high risk to the rights and freedoms of the data subject.
The notification must include the name and contact details of the Data Protection Officer (or point of contact), the likely consequences of the breach and any measures taken to remedy or mitigate the breach.
The controller may be exempt from notifying the data subject if the risk of harm is remote (e.g., because the affected data is encrypted), the controller has taken measures to minimise the risk of harm (e.g., suspending affected accounts) or the notification requires a disproportionate effort (e.g., a public notice of the breach).
16.4 What are the maximum penalties for personal data security breaches?
There is a maximum discretionary penalty of up to £1 million for breaches that are other than those prescribed in the GDPR.
17. Enforcement and Sanctions
17.1 Describe the enforcement powers of the data protection authority(ies).
(a) Investigative Powers:
- The ICO has powers of entry and inspection.
- Information Notice – requires a controller or processor to provide the ICO with the information that he reasonably requires.
- Through a warrant, the ICO can access all personal data, information, premises and equipment as necessary.
(b) Corrective Powers:
- Enforcement Notice – requires the recipient to take the steps specified in the Notice or refrain from taking the steps specified in the Notice.
- Assessment Notice – requires a controller or processor to permit the ICO to carry out an assessment of compliance with the data protection requirements.
(c) Authorisation and Advisory Powers: The Regulations provide the ICO with the power to issue various Codes of Practice.
(d) Imposition of administrative fines for infringements of specified legal provisions: The ICO can issue a penalty in relation to the infringement of a provision of the applied GDPR. The maximum amount for this penalty is £1 million.
(e) Non-compliance with a data protection authority: Failure to comply with an Information, Enforcement, Assessment or Penalty Notice may be certified to the High Court, which will treat the matter as contempt of court.
17.2 Does the data protection authority have the power to issue a ban on a particular processing activity? If so, does such a ban require a court order?
The Regulations entitle the ICO to impose a temporary or definitive limitation, including a ban on processing.
17.3 Describe the data protection authority’s approach to exercising those powers, with examples of recent cases.
Enforcement to date has been limited to Enforcement Notices and Formal Undertakings against Isle of Man data controllers.
17.4 Does the data protection authority ever exercise its powers against businesses established in other jurisdictions? If so, how is this enforced?
Enforcement to date has included Penalty Notices, Enforcement Notices and Formal Undertakings against Isle of Man data controllers.
18. E-discovery/Disclosure to Foreign Law Enforcement Agencies
18.1 How do businesses typically respond to foreign e-discovery requests, or requests for disclosure from foreign law enforcement agencies?
The duty of confidentiality and compliance with the data protection principles would be uppermost in the minds of companies responding to such requests. Traditionally, the obligation to exchange information, such as under automatic exchange of information regimes, would be covered in an organisation’s terms and conditions. For data protection reasons, though, exchange of information is often limited to Isle of Man statutory or public authorities, rather than data being released to foreign authorities. Isle of Man companies are very mindful of requests from foreign law enforcement agencies and would be keen to ensure that these have come through the appropriate channels in advance of replying to them.
18.2 What guidance has/have the data protection authority(ies) issued on disclosure of personal data to foreign law enforcement or governmental bodies?
The Isle of Man ICO has not issued any specific advice in regard to the disclosure of personal data to foreign law enforcement or government bodies.
Isle of Man Data Protection Law allows for the sharing of personal information with law enforcement and governmental bodies if it is proportionate and necessary. Transfer to a third country is permitted if the transfer is covered by an adequacy decision.
Where the adequacy regulations are not in place, the transfer may still be made where appropriate safeguards exist to determine that the rights of an individual are enforceable and legal remedy is available following the transfer.
19. Trends and Developments
19.1 What enforcement trends have emerged during the previous 12 months? Describe any relevant case law or recent enforcement actions.
From April 2023 onwards, the ICO has issued three Enforcement Notices. No Penalty Notices have been issued in the last 12 months but it is noted that a Reprimand was issued.
An Enforcement Notice released in April 2024 relates to a ban on the processing of personal data in respect of operating surveillance systems “inside” pupils’ toilets located on school premises with immediate effect.
There were two Enforcement Notices also issued in October 2023. This first Enforcement Notice related to failure to comply with Article 5(1)(d) (principle of accuracy) in respect of scanned patient records. The second Enforcement Notice related to failure to have a binding contract with relevant entities that used a specific system. This Enforcement Notice was issued following an investigation by the Commissioner into unauthorised access to personal data in the relevant system.
In July 2023, the ICO issued a Reprimand to 20 Public Authorities who were each impacted by the unauthorised access to personal data in the system used by those public authorities to record and manage FOI requests. It is not usual practice for the ICO to issue such a reprimand but the ICO in this instance considered that there was a clear public interest in doing so.
19.2 What “hot topics” are currently a focus for the data protection regulator?
The ICO is focused on publishing guidance and resources to assist data controllers and processors to comply with the Regulations and applied GDPR. The most recent guidance from the ICO focused on the personal use of CCTV.
Production Editor's Note
This chapter has been written by a member of ICLG's international panel of experts, who has been exclusively appointed for this task as a leading professional in their field by Global Legal Group, ICLG's publisher. ICLG's in-house editorial team carefully reviews and edits each chapter, updated annually, and audits each one for originality, relevance and style, including anti-plagiarism and AI-detection tools. This chapter was copy-edited by Maya Tyrrell , our in-house editor.
- Buy Chapter in PDF format £100
- Buy the Book in PDF format £295
